feat(attestor): command-run-ima — chain eBPF file traces to hardware root via Linux IMA + TPM (PCR-10)

[colek42]

Summary

Chain the command-run eBPF file trace to a hardware root of trust using Linux IMA (Integrity Measurement Architecture) + the TPM. A new command-run-ima capture mode correlates each eBPF-observed file open/read with its IMA measurement entry, which the kernel atomically extends into TPM PCR-10; a tpm-quote (#274) over PCR-10 then makes the whole file-evidence set cryptographically provable down to the manufacturer TPM root.

This is the piece that turns command-run's "we observed these files" into "the kernel measured these files and sealed them in hardware."

Why

command-run v0.2's eBPF capture is userspace — strong, but it can't itself prove the measurements reached an immutable, hardware-anchored log. IMA provides exactly that: every file matching IMA policy is hashed by the kernel and extended into PCR-10 (PCR10_new = H(PCR10_old ‖ template_hash)), kernel-synchronous and zero-drop. Pairing the IMA log with a TPM quote over PCR-10 gives an off-box verifier a tamper-evident chain:

file content → IMA measurement (template hash) → PCR-10 extend → TPM2_Quote → AK → EK → manufacturer root

This is the cryptographic backbone for the SLSA Build-Environment story and for hermeticity/complete-dependency-visibility: a verifier can confirm the exact set of files the build touched was measured into hardware, defeating post-open mutation, cache poisoning, and TOCTOU laundering.

Design

command-run-ima (sibling capture mode to v0.2 command-run, predicate https://aflock.ai/attestations/command-run/v0.2 extended, or command-run-ima/v0.1):

1. Snapshot /sys/kernel/security/ima/ascii_runtime_measurements (and the binary_runtime_measurements for multi-hash) before the trace; record boot_aggregate.
2. Run the wrapped command under the existing eBPF trace (unchanged).
3. Snapshot IMA after; diff to get the entries added during the build.
4. Correlate eBPF → IMA: for each observed OpenedFiles/WrittenDigests path, attach its IMA entry (template, template_hash, seqno, inode, ima-sig signature if present).
5. Reference a sibling tpm-quote (feat(attestor): tpm-quote — measured-boot + TPM2 quote bound to build id #274) over PCR-10 with nonce = build_id, recorded under _meta.tpmQuoteRef.
6. fs-verity: when IMA uses ima-ngv2, record the kernel fs-verity Merkle root per file so a verifier can bit-exact re-validate.

Reuses v0.2's _meta (incl. keyGuard); adds _meta.tpmQuoteRef, a per-file imaEntry, and an ordered pcrLog (the extend sequence) + pcrFinal + bootAggregate.

Verification (RegoV0 + verifier)

1. A matching tpm-quote subject exists and its nonce equals this build's id.
2. Replay the IMA extend sequence from bootAggregate and confirm it reproduces pcrFinal and the quote's PCR-10.
3. Every eBPF-observed path is present in the IMA log with a matching hash (no "observed-but-unmeasured" file).
4. Validate the quote's AK→EK→manufacturer-root chain (delegated to feat(attestor): tpm-quote — measured-boot + TPM2 quote bound to build id #274's gate).
5. ima-sig template → require a valid IMA signature per file; fs-verity enforced → optionally re-read and recompute the Merkle root to detect post-trace mutation.

Libraries / kernel

github.com/google/go-tpm{,-tools}, github.com/google/go-attestation; crypto/{sha256,x509}. Kernel: /sys/kernel/security/ima/{ascii,binary}_runtime_measurements, /sys/kernel/security/ima/policy, /proc/cmdline (ima=, ima_template=), /dev/tpmrm0. IMA event-log = TCG format: boot_aggregate then one PCR-10 extend per policy match.

Phased delivery

• MVP: command-run-ima predicate + Attest() (pre/post IMA snapshot, policy parse); link each v0.2 file to its IMA entry; --tpm-quote-ref binding by nonce + PCR-10; RegoV0 gate (PCR-10 replay, nonce binding, per-file presence).
• P2 (fs-verity): parse ima-ngv2, record Merkle roots, optional verifier re-read.
• P3: parse binary_runtime_measurements for multi-hash PCR-10 replay (sha256/384/512).
• P4: feature-detect IMA — auto-skip cleanly when /sys/kernel/security/ima/ is absent (no build breakage); container/VM namespace handling.

Open questions

• Bind tightness: IMA carries no nonce; how strongly to tie the IMA window to the tpm-quote nonce to prevent quote reuse.
• Require ima=enforce_ima (deny unknown opens) vs accept ima=audit_ima (log-only)?
• How much pre-exec IMA history to capture (boot context for PCR replay) vs only the new entries.
• fanotify (v0.2 zero-drop hashing) vs IMA precedence — confirm both observe the same opens.
• Container/VM isolation: shared host IMA log across builds; PID-namespace scoping vs treating the VM boundary as the root (paired with feat(attestor): tpm-quote — measured-boot + TPM2 quote bound to build id #274 / feat(attestor): cloud-attestation — hardware-rooted TEE quotes (AWS Nitro, GCP Confidential VM, Azure MAA) #275).
• Offline verification: vendored manufacturer root store vs fetch at verify time.

---

Depends on #274 (tpm-quote) for the PCR-10 root; complements #275 (cloud-attestation) on TEE platforms. Part of the hardware-root-of-trust track. Spec refs: SLSA Build-Environment track (draft).

Filed by an AI agent at Cole's request; design researched against Linux IMA / TCG event log + the command-run v0.2 eBPF attestor.